Xclarity Administrator (Lenovo) - vulnerabilities (CVEs)

29 CVEs, 0 in the last 30 days, 22 known versions, newest CVE from 2025-01-14. Vendor: Lenovo.

CVEs of Xclarity Administrator

CVE-2024-45102 - CVSS 6.8 (medium), 2025-01-14: A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC…
CVE-2024-45104 - CVSS 6.5 (medium), 2024-09-13: A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially…
CVE-2024-45103 - CVSS 4.3 (medium), 2024-09-13: A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges.
CVE-2024-45101 - CVSS 6.8 (medium), 2024-09-13: A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA…
CVE-2023-4605 - CVSS 6.5 (medium), 2024-04-05: A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information.
CVE-2023-34420 - CVSS 7.2 (high), 2023-06-26: A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API.
CVE-2023-3113 - CVSS 8.2 (high), 2023-06-26: An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only…
CVE-2023-34418 - CVSS 8.1 (high), 2023-06-26: A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a…
CVE-2023-34422 - CVSS 6.5 (medium), 2023-06-26: A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due…
CVE-2023-34421 - CVSS 6.5 (medium), 2023-06-26: A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to…
CVE-2020-8355 - CVSS 4.9 (medium), 2021-02-10: An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA…
CVE-2019-19756 - CVSS 7.9 (high), 2020-03-13: An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed…
CVE-2019-6193 - CVSS 7.5 (high), 2020-02-14: An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access…
CVE-2019-6194 - CVSS 5.7 (medium), 2020-02-14: An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow…
CVE-2019-19757 - CVSS 5.4 (medium), 2020-02-14: An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability…
CVE-2019-6181 - CVSS 6.1 (medium), 2019-09-03: A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow a crafted…
CVE-2019-6180 - CVSS 4.8 (medium), 2019-09-03: A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an…
CVE-2019-6179 - CVSS 7.5 (high), 2019-09-03: An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator…
CVE-2019-6182 - CVSS 4.9 (medium), 2019-09-03: A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to…
CVE-2019-6158 - CVSS 8.7 (high), 2019-05-03: An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This…
CVE-2018-9064 - CVSS 8.8 (high), 2018-07-30: In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the…
CVE-2018-9066 - CVSS 8.8 (high), 2018-07-30: In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into…
CVE-2018-9065 - CVSS 7.5 (high), 2018-07-30: In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a…
CVE-2017-17833 - CVSS 9.8 (critical), 2018-04-23: OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote…
CVE-2017-3764 - CVSS 5.3 (medium), 2017-11-30: A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with…
CVE-2017-3770 - CVSS 8.8 (high), 2017-09-22: Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interface functionality to…
CVE-2017-3763 - CVSS 6.7 (medium), 2017-09-22: An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts in LXCA versions…
CVE-2017-3745 - CVSS 7.8 (high), 2017-06-20: In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password…
CVE-2016-8233 - CVSS 9.8 (critical), 2017-03-01: Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear text form that…
CVE-2016-8221 - CVSS 7 (high), 2017-01-12: Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output…